ATT&CK coverage › Technique

Remote Access Tools T1219

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Events covered

6 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon7Image loaded
Sysmon11FileCreate
Sysmon13RegistryEvent (Value Set)
Sysmon22DNSEvent (DNS query)
Security-Auditing4688A new process has been created.

Authoring guide

Patterns shared across the 12 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (13 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image6ends_with 5, match 1\cmd.exe, \ssh-shellhost.exe, \COMODO\Endpoint Manager\ITSMService.exe, \TacticalAgent\tacticalrmm.exe, \code.exe
CommandLine5match 5, ends_with 2--accept-server-license-terms, pwsh, cmd, bash, --agent-type
isutility4eq 4True, TRUE
ParentImage3ends_with 3\ITSMService.exe, \code.exe, \code-tunnel.exe, \Velociraptor.exe
OriginalFileName2is_null 2
ParentCommandLine2ends_with 2 tunnel
EventID2eq 21, 7
registry_path2eq 2"*\\Microsoft\\Windows\\CurrentVersion\\Run*", "*\\SYSTEM\\CurrentControlSet\\Services\\*", "*\\SYSTEM\\Remote Manipulator System*"
TargetFilename1ends_with 1.ps1, .pif, .exe
dns.question.name1eq 1*
file_name1in 1"*.msi", "*.exe", "*echoware.dll"
registry_value_name1eq 1"ImagePath"
span1eq 130s

Top indicator values (75 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
CommandLinematch--accept-server-license-terms33
ParentCommandLineends_with tunnel22
CommandLinematch.exe tunnel22
CommandLineends_with.exe tunnel22
Imageends_with\cmd.exe292
CommandLinematch\servers\Stable-22
CommandLinematch/d /c 22
CommandLinematchcode-server.cmd22
isutilityeqTrue22
isutilityeqTRUE22
CommandLinematch--pty1
Imageends_with\ssh-shellhost.exe1
CommandLinematchpwsh15
CommandLinematchcmd15
CommandLinematchbash1
CommandLinematchpowershell116
ParentImageends_with\ITSMService.exe1
TargetFilenameends_with.vbs116
TargetFilenameends_with.zip14
TargetFilenameends_with.cmd18

Common exclusions (2 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
dns.question.namein"unknown"1
dns.question.namein"-"1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 6 rules

Splunk 6 rules